Fuzzing Cheat Sheet

Fuzzing = throwing inputs at a target to find hidden endpoints, parameters, or crashes. Interface vs. content discovery are the two main jobs.

Content / Directory Discovery

ffuf

# directories
ffuf -u http://target/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,204,301,302,403
# files with extensions
ffuf -u http://target/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-small-files.txt -e .php,.html,.bak,.txt,.zip
# vhosts (Host header virtual host fuzz)
ffuf -u http://target -H "Host: FUZZ.target.local" -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -mc 200 -fw <filter-wc>
# parameters (use from a saved request)
ffuf -u "http://target/?FUZZ=1" -w /wordlists/params.txt -fs <size-of-orig-response>

Filter responses: -fs <size> (hide by size), -fc <code>, -fw <words>, -fl <lines>, -mc 200,301
Follow redirects -r; headers/cookies -H/-b

gobuster

gobuster dir -u http://target -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -x php,txt,bak
gobuster dns -d target.com -w /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt
gobuster vhost -u http://target -w /wordlists/vhosts.txt

dirsearch / feroxbuster

dirsearch -u http://target -e php,html,txt
feroxbuster -u http://target -w /wordlists/raft-medium-directories.txt --dont-extract-links

Parameter & Value Fuzzing

Hidden GET params ffuf -u "http://target/page?FUZZ=1" -w params.txt -fs <baseline>
Common param names: id, user, username, password, file, path, url, redirect, lang, token, cmd, page, action, q, debug
Position values (IDOR/UID brute) often via ffuf with integer lists / Burp Intruder

Header Fuzzing

Brute important headers: X-Forwarded-For, X-Real-IP, X-Original-URL, X-Rewrite-URL, Host (vhost), Authorization
```
ffuf -u http://target -H "X-Forwarded-For: FUZZ" -w ips.txt -fs <baseline>
```

Web Application Fuzzing (mutation)

Use Burp Intruder with fuzz wordlists (/usr/share/seclists/Fuzzing/*)
Common fuzz seeds: FUZZ, { for SSTI, 1' OR '1'='1 for SQLi, < for XSS, null bytes %00, Unicode encodings
Feedback loop: change one thing, watch app error/status/length (WD of signatures)

Local Bruteforce (FFUF-style)

Subjects: hidden API routes (/api/FUZZ, /api/v1/FUZZ), backup names (config, backup, .git, .env, dump, admin.zip)
Always check for exposed: /robots.txt, /sitemap.xml, .git/HEAD, .env, phpinfo.php, /server-status, /actuator (Spring), swagger, /graphql

Good Wordlists

/usr/share/wordlists/
SecLists/Discovery/Web-Content/ (raft, directory-list-2.3*)
SecLists/Fuzzing/ (SQLi, fuzz-Bo0oM, special-characters, user-agents)

Rules

Fuzzing is loud: rate-limit (-rate 100), stay in scope, log everything.
Confirm findings by hand — status 200 ≠ vulnerable.